Standardize CI/CD: use homelab-frontend pattern (REGISTRY_PAT, docker:27-cli, all repos)

.forgejo/workflows/TEMPLATE.md

@@ -0,0 +1,156 @@
+# CI/CD Workflow Template for Poimen Repos
+
+## Pattern Used by Homelab-Frontend
+
+**File**: `.gitea/workflows/build-prod.yaml` (equivalent: `.forgejo/workflows/build.yaml`)
+
+### Key Components
+
+```yaml
+jobs:
+  build:
+    runs-on: golang  # or rust, or docker
+    container:
+      image: docker:27-cli
+      volumes:
+        - /docker-certs/client:/docker-certs/client:ro
+    env:
+      DOCKER_HOST: tcp://localhost:2376
+      DOCKER_TLS_VERIFY: "1"
+      DOCKER_CERT_PATH: /docker-certs/client
+    steps:
+      - name: Registry login
+        run: |
+          echo "${REGISTRY_PAT}" | docker login "${REGISTRY}" \
+            --username rock --password-stdin
+        env:
+          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
+      
+      - name: Build
+        run: docker build -t "${IMAGE}:latest" .
+      
+      - name: Push
+        run: docker push "${IMAGE}:latest"
+```
+
+---
+
+## How to Apply to Any Poimen Repo
+
+### Step 1: Create Personal Access Token
+
+```bash
+# In browser: https://git.riotpiao.com/user/settings/tokens
+# Or use the existing 'rock' PAT for the organization
+```
+
+### Step 2: Set Repository Secret
+
+Go to **`https://git.riotpiao.com/rock/<repo>/settings/secrets`**
+
+Add secret:
+- **Name**: `REGISTRY_PAT`
+- **Value**: `<token-from-step-1>`
+
+### Step 3: Create Workflow File
+
+Copy this to `.forgejo/workflows/build.yaml`:
+
+```yaml
+name: Build and Push
+
+on:
+  push:
+    branches: [main]
+
+env:
+  REGISTRY: forgejo.riotpiao.com
+  IMAGE_NAME: rock/<your-repo-name>
+
+jobs:
+  test:
+    runs-on: rust  # or golang, or docker
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run tests
+        run: cargo test --all  # adjust for your language
+
+  build:
+    runs-on: golang
+    needs: test
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    container:
+      image: docker:27-cli
+      volumes:
+        - /docker-certs/client:/docker-certs/client:ro
+    env:
+      DOCKER_HOST: tcp://localhost:2376
+      DOCKER_TLS_VERIFY: "1"
+      DOCKER_CERT_PATH: /docker-certs/client
+    steps:
+      - name: install node (required by JS-based actions)
+        run: apk add --no-cache nodejs git
+      
+      - uses: actions/checkout@v4
+      
+      - name: Registry login
+        run: |
+          echo "${REGISTRY_PAT}" | docker login "${REGISTRY}" \
+            --username rock --password-stdin
+        env:
+          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
+      
+      - name: Build
+        run: |
+          docker build \
+            -t "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" \
+            -t "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}" \
+            .
+      
+      - name: Push
+        run: |
+          docker push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest"
+          docker push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}"
+```
+
+---
+
+## Apply to Poimen Repos
+
+### poimen-memory ✅ (current)
+- Status: Uses `FORGEJO_TOKEN` (built-in)
+- Can upgrade to `REGISTRY_PAT` pattern
+
+### poimen (orchestrator)
+- If has Dockerfile: add workflow
+- If K8s-only: validate with `yamllint` + `kustomize`
+
+### poimen-workflows
+- If has Docker: add workflow
+- Otherwise: validate YAML only
+
+### Pattern for All Repos
+
+```
+.forgejo/workflows/
+├── build.yaml           # For repos with Dockerfile
+├── validate.yaml        # For K8s-only repos (like homelab)
+```
+
+---
+
+## Summary
+
+**Established Pattern**:
+1. `REGISTRY_PAT` secret in repo
+2. `docker login` → `docker build` → `docker push`
+3. Image tagged: `latest` + commit SHA
+4. ArgoCD watches and auto-deploys
+
+**Once set up once**: 
+- Every push triggers build
+- Image auto-pushes to registry
+- ArgoCD syncs automatically
+- Zero manual intervention
+
+**Effort**: ~5 minutes per repo (token + secret + workflow file)

.forgejo/workflows/build.yaml

@@ -8,7 +8,7 @@ on:
 
 env:
   REGISTRY: forgejo.riotpiao.com
-  IMAGE_NAME: rock/poimen-memory
+  IMAGE: forgejo.riotpiao.com/rock/poimen-memory
 
 jobs:
   test:
@@ -17,39 +17,49 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       
-      - name: Run cargo build
-        run: cargo build --workspace
-      
-      - name: Run cargo test
+      - name: Run tests
         run: cargo test --all
 
-  build-image:
-    name: Build and Push Image
-    runs-on: rust
+  build:
+    name: Build and push image
+    runs-on: golang
     needs: test
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    container:
+      image: docker:27-cli
+      volumes:
+        - /docker-certs/client:/docker-certs/client:ro
+    env:
+      DOCKER_HOST: tcp://localhost:2376
+      DOCKER_TLS_VERIFY: "1"
+      DOCKER_CERT_PATH: /docker-certs/client
     steps:
+      - name: install node (required by JS-based actions)
+        run: apk add --no-cache nodejs git
+
       - uses: actions/checkout@v4
-      
-      - name: Build Docker image
+
+      - name: Get short SHA
+        id: sha
+        run: |
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
+
+      - name: Registry login
+        run: |
+          echo "${REGISTRY_PAT}" | docker login "${REGISTRY}" \
+            --username rock --password-stdin
+        env:
+          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
+
+      - name: Build
         run: |
           docker build \
-            -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest \
-            -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} \
-            -f Dockerfile .
-          
-          echo "Built images:"
-          docker images | grep "${{ env.IMAGE_NAME }}"
-      
-      - name: Login to registry and push
+            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
+            -t "${IMAGE}:latest" \
+            .
+
+      - name: Push
         run: |
-          # Use Forgejo's actor token which has registry access
-          echo "${{ secrets.FORGEJO_TOKEN }}" | docker login ${{ env.REGISTRY }} \
-            -u ${{ github.actor }} --password-stdin
-          
-          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
-          
-          echo "Image pushed: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest"
-        env:
-          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
+          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
+          docker push "${IMAGE}:latest"